{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:66dd8add-143a-5466-97a3-419b470f62ab", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.11.3-tuxcare.3", "type": "library", "bom-ref": "pkg:npm/fastify@5.11.3-tuxcare.3", "version": "5.11.3-tuxcare.3", "pedigree": { "ancestors": [ { "name": "fastify", "purl": "pkg:npm/fastify@5.11.3", "type": "library", "version": "5.11.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2018-3711", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:cfbb6715-a70a-53aa-aaf8-6069a169dc3b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-3711 does not affect version 5.11.3-tuxcare.3 of fastify. not_affected \u2014 CVE-2018-3711 describes a DoS vulnerability in fastify where processing requests with Content-Type: application/json and very large payloads could exhaust server resources. The fix was introduced in upstream version 0.38.0 (commit fabd2a01 by Nathan Woltman) which added bodyLimit validation with a default 1 MB limit. The target version 5.11.3 already contains this fix as it was shipped in the u...", "justification": "code_not_present" } }, { "id": "CVE-2020-8192", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:f0652b29-56a7-5449-aea2-a1da70df4987", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-8192 does not affect version 5.11.3-tuxcare.3 of fastify. not_affected \u2014 CVE-2020-8192 was fixed in upstream Fastify v2.15.1 (June 2020) by disabling the `allErrors` Ajv option by default. The target version 5.11.3 contains this fix. The vulnerability required `allErrors: true` to trigger resource exhaustion with specially crafted schemas. The fix changed the default to `allErrors: false` with explicit documentation warning users about the DoS risk if they re-enable...", "justification": "code_not_present" } }, { "id": "CVE-2022-39288", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:2496d754-aadf-5103-989a-84477ea6f719", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-39288 does not affect version 5.11.3-tuxcare.3 of fastify. not_affected \u2014 CVE-2022-39288 affects Fastify v4.x (fixed in v4.8.0+) where malicious Content-Type headers containing Object prototype property names (constructor, toString, etc.) caused crashes via prototype pollution. The target (Fastify v5.11.3-tuxcare.7) is NOT AFFECTED because the upstream fix (commit fbb07e8dfad74c69cd4cd2211aedab87194618e3, Oct 2022) replaced plain object storage with Map-based storage...", "justification": "code_not_present" } }, { "id": "CVE-2022-41919", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:fba2c736-4dc0-5477-809e-bde75977efe1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-41919 does not affect version 5.11.3-tuxcare.3 of fastify. not_affected \u2014 Target version 5.11.3 is not affected by CVE-2022-41919 (Content-Type spoofing enabling CSRF via CORS preflight bypass). The vulnerability allowed attackers to send requests with spoofed Content-Type headers (e.g., 'text/plain; content-type=\"application/json\"') to confuse Fastify's parser selection logic. The fix, which introduced proper RFC 9110-compliant Content-Type parsing, was already pres...", "justification": "code_not_present" } }, { "id": "CVE-2025-32442", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:7bf71ef4-fdb0-55be-9eca-3b473a0f89cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-32442 affects version 5.11.3-tuxcare.3 of fastify." } }, { "id": "CVE-2026-107832", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:81eeea2c-5111-558e-a0a3-44481eb574d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-107832 affects version 5.11.3-tuxcare.3 of fastify." } }, { "id": "CVE-2026-120216", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:4cb34747-9972-5a23-bccd-2b1e7ed71a9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-120216 affects version 5.11.3-tuxcare.3 of fastify." } }, { "id": "CVE-2026-16732", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:d1fda329-43bd-52bd-9aa9-5c67a0e8940c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-16732 is fixed in version 5.11.3-tuxcare.3 of fastify." } }, { "id": "CVE-2026-18504", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:34ff3f56-19b0-5aea-87b6-500322cf01ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-18504 is fixed in version 5.11.3-tuxcare.3 of fastify." } }, { "id": "CVE-2026-25223", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:b9f4b574-5840-56b7-87b8-484dae3fbb75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25223 affects version 5.11.3-tuxcare.3 of fastify." } }, { "id": "CVE-2026-25224", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:b24c5f18-ceb3-5f98-af88-51837b934b77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25224 does not affect version 5.11.3-tuxcare.3 of fastify. not_affected \u2014 The target Fastify 5.11.3-tuxcare.7 is NOT affected by CVE-2026-25224. The upstream fix for Web Stream backpressure handling was already present in Fastify 5.11.3 (fixed in upstream 5.7.3 per CVE). The vulnerable pattern (ignoring res.write() backpressure signals) is not present in the target code. The fix at lib/reply.js:762,795-810 properly pauses stream reads when the write buffer is full, p...", "justification": "code_not_present" } }, { "id": "CVE-2026-33806", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:63125d07-0d72-5f2a-a2f2-f4753685fb6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-33806 affects version 5.11.3-tuxcare.3 of fastify." } }, { "id": "CVE-2026-3419", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:88852e8d-2321-51cf-bd13-27208b6a8fa0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3419 does not affect version 5.11.3-tuxcare.3 of fastify. not_affected \u2014 CVE-2026-3419: Target version 5.11.3-tuxcare.7 is NOT AFFECTED. The vulnerability (accepting malformed Content-Type headers with trailing garbage) was fixed in upstream commit 67f6c9b3 (March 5, 2026) by adding a `$` anchor to the subtypeNameReg regex. This fix was already included in the upstream v5.11.3 release (August 8, 2026) before TuxCare onboarded it. The vulnerable code pattern is not p...", "justification": "code_not_present" } }, { "id": "CVE-2026-3635", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:a459434b-d86c-5249-9c05-c7330970346a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-3635 does not affect version 5.11.3-tuxcare.3 of fastify. not_affected \u2014 CVE-2026-3635 (X-Forwarded-* header spoofing with restrictive trustProxy) is NOT present in fastify 5.11.3-tuxcare.7. The vulnerability was fixed in upstream commit 4e1db5bd by TinkAnet (lzhao61@jh.edu) and shipped in upstream release v5.11.3. The target is based on this pre-fixed upstream release. The fix gates the host and protocol getters on proxyFn(socket.remoteAddress, 0), ensuring X-Forwa...", "justification": "code_not_present" } }, { "id": "CVE-2026-53384", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:37fc3cb0-724f-5aee-8574-4b09ac3c3c65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-53384 is fixed in version 5.11.3-tuxcare.3 of fastify." } }, { "id": "CVE-2026-76169", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:c1aae781-ad96-5ee7-a043-faadaa86b77a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-76169 affects version 5.11.3-tuxcare.3 of fastify, and is fixed in 5.11.3-tuxcare.4." } }, { "id": "CVE-2026-84428", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:58d6656e-1644-5c5a-9f0a-62a2bd2002c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84428 affects version 5.11.3-tuxcare.3 of fastify, and is fixed in 5.11.3-tuxcare.6." } }, { "id": "CVE-2026-84469", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:cafca31e-52d7-5c27-a61e-0fd9cbad579e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84469 affects version 5.11.3-tuxcare.3 of fastify, and is fixed in 5.11.3-tuxcare.6." } }, { "id": "CVE-2026-84504", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:977d6c96-e345-52e8-867b-5a8a32aa2641", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-84504 affects version 5.11.3-tuxcare.3 of fastify, and is fixed in 5.11.3-tuxcare.5." } }, { "id": "CVE-2026-92081", "affects": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ], "bom-ref": "urn:uuid:0d7e9166-da79-573b-b5c4-8806e0ff21f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-92081 affects version 5.11.3-tuxcare.3 of fastify, and is fixed in 5.11.3-tuxcare.6." } } ], "dependencies": [ { "ref": "pkg:npm/fastify@5.11.3-tuxcare.3" } ] }